In this section, I examine the dataset through the lens of tactical intelligence — uncovering patterns across time, geography, organizational presence, types of violence, and perpetrator characteristics. Each visualization contributes to constructing a clearer picture of the risk environment faced by humanitarian actors in volatile regions.
This EDA lays the groundwork for more advanced operational analysis — including anomaly detection, actor - motive clustering, and region - specific risk modeling.
Incident Hotspots by Geography
How have incident locations shifted — and where do they concentrate most?
Figure 2: Animated progression of aid worker attacks from 1997 to 2025, revealing the volatility and shifting epicenters of operational risk across time.
Figure 3: High - density clusters in East Africa, South Asia, and the Sahel highlight persistent operational vulnerabilities — pinpointing regions where threat exposure is entrenched over time.
Insight: Urban-Rural Divide
Preliminary geospatial inspection suggests clustering in both urban flashpoints (e.g., Mogadishu, Kabul) and rural corridors (e.g., Sahelian belt), accentuating the challenge of one-size-fits-all security policies.
Organizational Risk Exposure
Which agencies are most frequently involved in attacks?
Figure 4: INGOs and NNGOs experience the brunt of violent incidents—suggesting that footprint scale, mission scope, and regional penetration correlate with heightened threat exposure.
Victim Pathways: Aid Worker Roles and Incident Outcomes
Who bears the brunt of violence - international or national staff?
Figure 5: National staff absorb the overwhelming majority of violence — particularly deaths and injuries — underscoring structural disparities in frontline exposure and security provisioning.
Modus Operandi: Forms of Violence
What forms of violence are most common?
Code
attack_modes <- df |>count(`Means of attack`, sort =TRUE)mod_plot <-ggplot(attack_modes, aes(x = n, y =reorder(`Means of attack`, n))) +geom_point(aes(text =paste0("Method: ", `Means of attack`, "<br>Incidents: ", n)),size =4, color ="#FF5C5C") +labs(title ="Modus Operandi: Attack Types Against Aid Workers",x ="Reported Incidents", y =NULL ) +theme_minimal(base_size =10)ggplotly(mod_plot, tooltip ="text") |>layout(margin =list(t =90) )
Figure 6: Shootings, kidnappings, and bodily assaults dominate the landscape of violence — requiring field protocols that span both rapid - response and long - duration risk containment.
Tactical Implication
Shootings and kidnappings account for the majority of attacks—suggesting field teams need flexible protocols that account for both short-range threats and prolonged abductions.
Threat Actor Profile
Who is behind these attacks?
Code
actor_types <- df |>count(`Actor type`, sort =TRUE)actor_plot <-ggplot(actor_types, aes(x = n, y =reorder(`Actor type`, n))) +geom_segment(aes(x =0, xend = n, yend =`Actor type`), color ="#F4A261") +geom_point(aes(text =paste0("Threat Actor: ", `Actor type`, "<br>Incidents: ", n)),size =4, color ="#F4A261") +labs(title ="Threat Actor Landscape",x ="Confirmed Incidents", y =NULL ) +theme_minimal(base_size =10)ggplotly(actor_plot, tooltip ="text") |>layout(margin =list(t =90) )
Figure 7: Over 50% of incidents list the perpetrator as “Unknown,” reflecting both fog-of-war conditions and the limitations of ground - level intelligence gathering in active zones.